01 Record

CVE-2016-0778

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly

HighPUBLISHEDCNA: redhat

CNA base score8.1 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

20.90% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 97.4% of scored records. A rank, not a probability.

NVD base score

8.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2016-01-14 00:00Z10 YR AGO

Last updated

2026-05-29 20:28Z3 MO AGO

Reserved

2015-12-16

Assigning CNA

redhat

Record state

PUBLISHED

Severity

High (CVSS 8.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferClass
CWE-122Heap-based Buffer OverflowVariant

Data version

5.2

Document digest

8548192b1132049af048daaf207fedce8cc9a3923de73fbffc60610a80d54f1f

05 Affected products

VendorProductVersionsPlatforms

applemac_os_xNot specified—

hpvirtual_customer_access_systemNot specified—

openbsdopensshNot specified—

oraclelinuxNot specified—

oraclesolarisNot specified—

redhatenterprise_linuxNot specified—

sophosunified_threat_management_softwareNot specified—

06 References

blogs.sophos.comhttps://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
lists.opensuse.orgSUSE-SU-2016:0117http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.htmlvendor-advisory
blogs.sophos.comhttps://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
lists.apple.comAPPLE-SA-2016-03-21-5http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlvendor-advisory
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375
www.securityfocus.com20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778http://www.securityfocus.com/archive/1/537295/100/0/threadedmailing-list
support.apple.comhttps://support.apple.com/HT206167
lists.fedoraproject.orgFEDORA-2016-4556904561http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.htmlvendor-advisory
kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
www.openssh.comhttp://www.openssh.com/txt/release-7.1p2
lists.opensuse.orgopenSUSE-SU-2016:0128http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.htmlvendor-advisory
www.securityfocus.com80698http://www.securityfocus.com/bid/80698vdb-entry
lists.fedoraproject.orgFEDORA-2016-2e89eba0c1http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.htmlvendor-advisory
bto.bluecoat.comhttps://bto.bluecoat.com/security-advisory/sa109
www.securitytracker.com1034671http://www.securitytracker.com/id/1034671vdb-entry
lists.opensuse.orgopenSUSE-SU-2016:0127http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.htmlvendor-advisory
security.gentoo.orgGLSA-201601-01https://security.gentoo.org/glsa/201601-01vendor-advisory
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
www.openwall.com[oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778http://www.openwall.com/lists/oss-security/2016/01/14/7mailing-list
seclists.org20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778http://seclists.org/fulldisclosure/2016/Jan/44mailing-list
lists.opensuse.orgSUSE-SU-2016:0119http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.htmlvendor-advisory
packetstormsecurity.comhttp://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
lists.opensuse.orgSUSE-SU-2016:0118http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.htmlvendor-advisory
lists.opensuse.orgSUSE-SU-2016:0120http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.htmlvendor-advisory
www.ubuntu.comUSN-2869-1http://www.ubuntu.com/usn/USN-2869-1vendor-advisory
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
www.debian.orgDSA-3446http://www.debian.org/security/2016/dsa-3446vendor-advisory
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

01 Record index

CVE-2016-0778

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2016-0778

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References